Skip to content

v2026.4.14

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Apr 19:06
v2026.4.14
d4fb4cd
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Dashboard cookie dep bumped from 0.6.0 to 1.1.1 -- patches GHSA advisory where malicious cookie name/path/domain values could inject other cookie fields. cookie is a transitive dep via @sveltejs/kit, @sveltejs/adapter-static, and bits-ui; none have bumped upstream, so we pin via pnpm.overrides

Fixed

  • CI pnpm pinning -- replaced pnpm/action-setup@v6 with corepack across security.yml, release.yml, and testpypi.yml. The v6 action hardcodes pnpm 11 beta in its bootstrap lockfile and silently ignores both version: and packageManager, which broke every workflow that uses a pnpm 10 lockfile (ERR_PNPM_BROKEN_LOCKFILE). Corepack reads packageManager from dashboard/package.json directly

Changed

  • Dashboard packageManager field -- dashboard/package.json now pins pnpm@10.32.1 as the canonical dev/CI version. Contributors can run corepack enable once to auto-pin
Assets 4
Loading